Set up SPF, DKIM and DMARC for a Shopify domain
The principle is simple: whoever sends your email generates the values, you paste them into Shopify. For your store's own emails — order confirmations, shipping updates, Shopify Email campaigns — the sender is Shopify itself, and the values are the CNAME records shown under Settings → Notifications → Sender email. For the mailbox you reply from (Google Workspace, Microsoft 365), the values come from that provider. All of them land in the same panel: Settings → Domains → your domain → DNS settings → Manage → Add custom record.
The one thing Shopify won't do properly for you is DMARC. On a Shopify-managed domain it publishes the bare minimum — v=DMARC1; p=none; with no reporting address — and its automatic authentication option, in Shopify's own words, "sets up your CNAME records to handle DKIM and SPF authentication, but doesn't configure a DMARC record." That's the record you'll be editing below.
These three records let receiving mail servers check that a message claiming to be from you really is from you. They do not guarantee your email reaches the inbox — your content and sending reputation matter at least as much — but without them, anyone can send email in your name, and since February 2024 Shopify rewrites unauthenticated senders to a shopifyemail.com address.
What we don't do: we never touch your DNS zone. We read, we prescribe, you paste. You're the one who clicks Confirm, in your own Shopify admin, with your own credentials.
Before anything else: is Shopify actually holding your DNS?
Shopify draws the line in one sentence: "If you buy your domain through Shopify or transfer a third-party domain to Shopify, then you can access and edit your DNS settings from your Shopify admin." That's a Shopify-managed domain, and this guide is for you.
If you connected a domain you bought elsewhere, Shopify only ever asked your registrar for an A record and a www CNAME. Everything else stayed there: "After you connect your domain to Shopify, you still need to log in to your third-party domain provider to manage domain settings, pay for your domain, and renew it." The records below don't change — only the panel does. Add them at GoDaddy, Cloudflare, Squarespace or wherever your name servers point, using our guide for that host.
Don't expect the word "Shopify" in your name servers, either. Shopify publishes no list of them, and on the Shopify-managed domains we looked up while writing this guide, the name servers carried a cloud DNS provider's name, not Shopify's. The reliable test is in your admin: under Settings → Domains, a Shopify-managed domain shows a DNS settings section. A connected domain doesn't.
Record types you can add: Shopify lists six — "A record, CNAME record, MX record, TXT record, AAAA record, SRV record." TXT and CNAME are both there, so SPF, DKIM and DMARC are all doable.
The records to copy and paste
1. Shopify's own emails — the CNAME records from Sender email
Shopify authenticates your store's emails with CNAME records, not an SPF line: "Shopify's CNAME records handle SPF automatically. No separate SPF TXT record is required for this purpose."
| Shopify field | Value |
|---|---|
| Type | CNAME Record |
| Name | the host shown in your Sender email modal, without your domain at the end |
| Target | the target shown in your Sender email modal |
…and the same again for each record in the modal — "The number of records may vary, so you must add all records displayed in the modal."
What you must replace: all of it. Name and target are generated for your store; nobody can publish them in advance, and any tutorial handing you a ready-made pair is guessing.
A note on the second field. Shopify never names it in its own documentation for its own DNS editor — its help centre only says that the label varies from one domain host to the next, and you may see Points to, Target or Value. Whatever it's called on your screen, it takes the target from the modal, unchanged.
If your domain is Shopify-managed, Shopify says this is already done. "If your domain was purchased through Shopify, your email authentication is set up automatically, and your DKIM, SPF, and DMARC records are configured for you." Elsewhere: "No action is required." Believe it about the CNAMEs. Don't believe it about DMARC — see section 4 and mistake 1.
Two cautions Shopify prints in red. "Before you begin, ensure that your store is on an active paid plan." Adding CNAME records isn't possible for client transfer stores, development stores, or stores on the Pause and Build plan. And later: "Removing the CNAME records that you added during email authentication can cause deliverability issues, including bounces." They also cost you your sender address — your sender email automatically reverts to a
store+123@shopifyemail.comform.
2. DKIM for your mailbox — the signature on the emails you write yourself
Shopify's CNAMEs sign Shopify's emails. The address you reply to customers from is signed by whoever hosts that mailbox, and Shopify doesn't host mailboxes: "Email hosting isn't provided on Shopify. You need to use a third-party email hosting service."
Google Workspace — one TXT record, generated in the Google Admin console under Menu → Apps → Google Workspace → Gmail → Authenticate email → Generate New Record, default selector google:
| Shopify field | Value |
|---|---|
| Type | TXT Record |
| Name | google._domainkey |
| TXT value | v=DKIM1; k=rsa; p=THE-LONG-KEY-SHOWN-IN-YOUR-ADMIN-CONSOLE |
What you must replace: the whole p= part — it's generated for your domain. Google offers 2048-bit keys ("recommended if your provider supports them") or 1024-bit "if your domain host has limitations". Once saved, go back to Authenticate email and click Start authentication.
Microsoft 365 — two CNAME records, hosts selector1._domainkey and selector2._domainkey, targets generated in the Microsoft Defender portal under Email authentication settings → DKIM. Add them as CNAME Record, Name = the selector only, target = what Microsoft shows.
⚠️ Never trust a tutorial that hands you a ready-made Microsoft 365 DKIM value. Since May 2025, Microsoft uses a new CNAME format for custom domains added after that date — it ends in
…<DynamicPartitionCharacter>-v1.dkim.mail.microsoft, and Microsoft describes that character as "dynamically generated… automatically assigned by Microsoft when you add a new custom domain and enable DKIM." It is genuinely impossible to guess.
3. SPF — who is allowed to send as you
| Shopify field | Value |
|---|---|
| Type | TXT Record |
| Name | @ |
| TXT value | v=spf1 include:_spf.google.com ~all |
What you must replace: the include:, almost certainly. The line above is Google's published value for Google Workspace, not a Shopify value. Use whatever actually sends from your mailbox address:
| Your email service | What goes in your SPF |
|---|---|
| Google Workspace | include:_spf.google.com |
| Microsoft 365 | include:spf.protection.outlook.com |
| Shopify email forwarding (Shopify-managed domain) | include:_spf.hostedemail.com — Shopify's own published value |
| Shopify's store emails and Shopify Email campaigns | (nothing — "No separate SPF TXT record is required") |
| Brevo, SendGrid, your CRM | the value shown in their interface |
If several services send on your behalf, they all go in one single line:
v=spf1 include:_spf.google.com include:_spf.hostedemail.com ~all
⚠️ One SPF record per domain. Always. Two
v=spf1lines don't mean double protection, they mean no SPF at all — not for the new tool, and not for the mailbox that worked yesterday. Microsoft puts the mechanism plainly: "Multiple SPF TXT records for the same domain or subdomain cause SPF to returnpermerror." When you add a sending tool, you edit the line you already have: Actions → Edit on the existing TXT record, never Add custom record.
The forwarding SPF is real, and it's the only SPF value Shopify publishes. Its email-forwarding article tells you to add a TXT Record with
@as the Name andv=spf1 include:_spf.hostedemail.com ~allas the TXT value, to your Shopify-managed custom domain. If you use forwarding and a Google Workspace mailbox on the same domain, that's two includes in one line, as above — not two records. (Microsoft's own line ends in-allrather than~all; either works with DMARC. If you're unsure what else sends as you, start with~all.)
4. DMARC — the instruction you give to inboxes
| Shopify field | Value |
|---|---|
| Type | TXT Record |
| Name | _dmarc |
| TXT value | v=DMARC1; p=none; rua=mailto:YOU@YOUR-DOMAIN.com |
What you must replace: YOU@YOUR-DOMAIN.com with an address you actually read. That's where your reports land, and a DMARC record without a rua= is a report you'll never see.
Compare with Shopify's minimum. Shopify tells merchants to publish v=DMARC1; p=none; — "A minimum of v=DMARC1; p=none" is what it asks for. That line satisfies Gmail and Yahoo. It sends you nothing. On the Shopify-managed domains we looked up while writing this guide, the automatically configured _dmarc record was exactly that: p=none, no reporting address. Add yours.
Why p=none first. It means "watch and tell me". Nobody gets blocked, nothing changes for your customers, and you start receiving a list of everything sending in your name — Shopify, your mailbox, the review app you'd forgotten about. You watch for two to four weeks, confirm every legitimate sender is recognised, and only then tighten one notch to p=quarantine, then p=reject. Google agrees: "When you start using DMARC, we recommend setting the policy option (p) to none."
⚠️ One DMARC record per domain, and Shopify is unforgiving about it. "Your domain must have only one DMARC record." Having multiple DMARC TXT records causes DMARC validation to fail, and your sender email may be rewritten to a
store+123@shopifyemail.comaddress. If_dmarcalready exists in your DNS settings — Shopify may have put it there — you edit it (Actions → Edit). You don't add a second one.
⚠️ Leave alignment relaxed. Shopify asks you to make sure your DMARC record doesn't include
adkim=soraspf=s, and to change them toadkim=randaspf=rif it does. Strict alignment stops Shopify's own transactional email from aligning. Relaxed is the default when you don't write the tags — so the safe move is simply not to add them.
Google's example is a bad one to copy. Google's DMARC article illustrates the record with
v=DMARC1; p=reject; rua=…; pct=100; adkim=s; aspf=s. On a Shopify store that's three problems in one line:p=rejectbefore you've read a single report, strict alignment that Shopify explicitly warns against, andpct=, which was removed from the DMARC standard by RFC 9989 (May 2026). Take Google's advice (start atp=none), not its example.
The click path
On Shopify's side — get the Sender email values (third-party or transferred domains; skip if Shopify shows your domain as already authenticated):
- From your Shopify admin, go to Settings → Notifications.
- In the Sender email section, click authenticate your domain.
- Copy every CNAME shown in the modal. Keep the tab open.
Shopify also offers Email domain authentication → Authenticate automatically, which writes the records for you — but only when your DNS is at Cloudflare, GoDaddy or IONOS. And it stops short: "Automatic authentication sets up your CNAME records to handle DKIM and SPF authentication, but doesn't configure a DMARC record." On a Shopify-managed domain it isn't needed; on any other host, it's the manual path.
On your mailbox provider's side — get the DKIM value. Google Workspace: Admin console → Apps → Google Workspace → Gmail → Authenticate email → Generate New Record; SPF is the fixed line above. Microsoft 365: Defender portal → Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM.
In Shopify's DNS editor — create the records:
- From your Shopify admin, go to Settings → Domains.
- Click the domain that you want to configure.
- In the DNS settings section, click Manage.
- Click Add custom record, then select the record type — TXT Record for SPF, Google's DKIM and DMARC; CNAME Record for Shopify's and Microsoft's DKIM.
- Fill in Name (
@for your root domain, otherwise the prefix only — Shopify's own instruction for a subdomain is "only enter the subdomain name") and the value field, then click Confirm. - Repeat for the next record.
To edit an existing record — your current SPF line, or a _dmarc Shopify already created — click Actions → Edit on that row, change it, Confirm. To remove one: Actions → Remove, then Remove. Shopify's warning is about its own A, AAAA and CNAME records: removing or changing those can break the connection between your domain and Shopify. Your TXT records aren't on that list.
Back on the provider's side — verify. Shopify: reopen Settings → Notifications and check the Sender email section. Google: Authenticate email → Start authentication. Microsoft: the DKIM tab, enable signing for the domain.
Ignore one sentence in Shopify's DNS article. It says: "When you add a new MX or TXT record, don't edit the name field." Taken literally, that would make
_dmarcandgoogle._domainkeyimpossible. Shopify's own email-forwarding article contradicts it — it has you enter@as the Name of a TXT Record in that same editor — and its domain-verification article has you type@or a subdomain into the same field. Follow the pages that give you a value to type.
On TTL: Shopify's add-record form isn't documented as having a TTL field, and Shopify publishes no default value. If you see one, leave it alone; don't go hunting for a number to type.
The 3 mistakes we see most often here
1. Reading "No action is required" and closing the tab
For a domain bought through Shopify, the help centre says your "DKIM, SPF, and DMARC records are configured for you." Two things that sentence does not say. First, it's about Shopify's emails — the mailbox you reply from still needs its own SPF and DKIM, from Google or Microsoft, and Shopify's article on email hosting mentions none of them. Second, the DMARC Shopify configures is the bare minimum: p=none with no rua=. Your domain answers "DMARC: yes" to any checker, and you have never seen a single report. You'll find out someone is sending in your name the day a customer forwards you the phishing email.
How you spot it: a scan shows DMARC present but no reporting address, or SPF missing for the mailbox provider your MX records point to.
The fix: edit _dmarc to add rua=mailto:… (same p=none — you lose nothing), then add your mailbox provider's SPF and DKIM as in sections 2 and 3.
2. Getting your sender rewritten to a shopifyemail.com address
Shopify documents three ways to lose your branded sender, and all three look like responsible behaviour. Two DMARC records — Shopify already had one, your ESP or your registrar offered another, and having multiple DMARC TXT records causes DMARC validation to fail. Strict alignment — you added adkim=s; aspf=s to "harden" DMARC, and Shopify's transactional mail stops aligning. Deleted CNAMEs — you cleaned up records you didn't recognise, and your sender email reverts to the store+123@shopifyemail.com form.
How you spot it: order confirmations arrive from a shopifyemail.com address instead of yours, or a scan reports "multiple DMARC records".
The fix: one _dmarc TXT, adkim and aspf absent or set to r, and the Sender email CNAMEs left exactly where Shopify put them.
3. Adding an SPF record "for Shopify", or a second SPF line
You know SPF matters, so you go looking for Shopify's include:. There isn't one — "Shopify's CNAME records handle SPF automatically. No separate SPF TXT record is required for this purpose." What people do instead is paste the forwarding SPF from Shopify's help centre next to the Google Workspace SPF they already had. Two v=spf1 lines, and SPF stops working for everything, including the mailbox that was fine yesterday.
How you spot it: a scan reports "multiple SPF records" or SPF in permerror while each line looks fine on its own.
The fix: one line, all your includes inside it: v=spf1 include:_spf.google.com include:_spf.hostedemail.com ~all if you use both. Actions → Edit on the existing record, not Add custom record.
How long before it takes effect
- In Shopify: saved as soon as you click Confirm.
- On the internet: Shopify gives three figures depending on the page — "Changes to your DNS settings can take up to 24 hours to take effect" (DNS settings article), "Changes can take up to 48 hours to complete" (Sender email article), and "This usually happens within two hours, but can take up to two days" (connecting a domain). Assume 48, expect much less.
- For Shopify's email forwarding: its own advice is to "wait at least 48 hours for DNS changes to propagate" before testing.
- For Google Workspace: "It can take up to 48 hours for SPF authentication to start working", the same 48 hours for DKIM, and on a brand-new account 24–72 hours before you can get your DKIM key in the Admin console.
- For Microsoft 365: "a few minutes (or possibly longer)" before the portal detects your CNAMEs.
- For DMARC reports: the first ones arrive 24 to 72 hours after you publish, then roughly once a day.
Wait an hour before clicking any verify button, then wait again. Clicking twelve times in five minutes only adds doubt.
Frequently asked questions
Do I need an SPF record for Shopify?
Not for your store's emails: "Shopify's CNAME records handle SPF automatically. No separate SPF TXT record is required for this purpose." You do need one for the mailbox you reply from — Google Workspace, Microsoft 365 — and one for Shopify's email forwarding. All of it goes in a single v=spf1 line, never two.
Does Shopify set up DMARC for me?
On a Shopify-managed domain, Shopify says your DKIM, SPF and DMARC records are "configured for you" — but the DMARC it publishes is the minimum, v=DMARC1; p=none;, with no reporting address. Your domain passes any checker and you never see a report. Edit that record to add rua=mailto:…, keeping p=none.
Why do my order emails come from store+123@shopifyemail.com?
Because DMARC validation failed. Shopify documents three causes: more than one DMARC record on the domain, strict alignment (adkim=s, aspf=s), or Sender email CNAMEs that were deleted. The fix is one _dmarc TXT record, alignment left out or set to r, and those CNAMEs put back.